src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c

   1 /*
   2  * eap_fast.c  contains the interfaces that are called from the main handler
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  *   Copyright 2016 Alan DeKok <aland@freeradius.org>
  21  *   Copyright 2016 The FreeRADIUS server project
  22  */
  23
  24 RCSID("$Id$")
  25
  26 #include "eap_fast.h"
  27 #include "eap_fast_crypto.h"
  28 #include <freeradius-devel/sha1.h>
  29 #include <openssl/ssl.h>
  30 #include <openssl/rand.h>
  31
  32 #define RANDFILL(x) do { rad_assert(sizeof(x) % sizeof(uint32_t) == 0); for (size_t i = 0; i < sizeof(x); i += sizeof(uint32_t)) *((uint32_t *)&x[i]) = fr_rand(); } while(0)
  33
  34 /*
  35  * Copyright (c) 2002-2016, Jouni Malinen <j@w1.fi> and contributors
  36  * All Rights Reserved.
  37  *
  38  * These programs are licensed under the BSD license (the one with
  39  * advertisement clause removed).
  40  *
  41  * this function shamelessly stolen from from hostap:src/crypto/tls_openssl.c
  42  */
  43 static int openssl_get_keyblock_size(REQUEST *request, SSL *ssl)
  44 {
  45         const EVP_CIPHER *c;
  46         const EVP_MD *h;
  47 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
  48         int md_size;
  49
  50         if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL ||
  51             ssl->read_hash == NULL)
  52                 return -1;
  53
  54         c = ssl->enc_read_ctx->cipher;
  55         h = EVP_MD_CTX_md(ssl->read_hash);
  56         if (h)
  57                 md_size = EVP_MD_size(h);
  58         else if (ssl->s3)
  59                 md_size = ssl->s3->tmp.new_mac_secret_size;
  60         else
  61                 return -1;
  62
  63         RDEBUG2("OpenSSL: keyblock size: key_len=%d MD_size=%d "
  64                    "IV_len=%d", EVP_CIPHER_key_length(c), md_size,
  65                    EVP_CIPHER_iv_length(c));
  66         return 2 * (EVP_CIPHER_key_length(c) +
  67                     md_size +
  68                     EVP_CIPHER_iv_length(c));
  69 #else
  70         const SSL_CIPHER *ssl_cipher;
  71         int cipher, digest;
  72
  73         ssl_cipher = SSL_get_current_cipher(ssl);
  74         if (!ssl_cipher)
  75                 return -1;
  76         cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher);
  77         digest = SSL_CIPHER_get_digest_nid(ssl_cipher);
  78         RDEBUG2("OpenSSL: cipher nid %d digest nid %d", cipher, digest);
  79         if (cipher < 0 || digest < 0)
  80                 return -1;
  81         c = EVP_get_cipherbynid(cipher);
  82         h = EVP_get_digestbynid(digest);
  83         if (!c || !h)
  84                 return -1;
  85
  86         RDEBUG2("OpenSSL: keyblock size: key_len=%d MD_size=%d IV_len=%d",
  87                    EVP_CIPHER_key_length(c), EVP_MD_size(h),
  88                    EVP_CIPHER_iv_length(c));
  89         return 2 * (EVP_CIPHER_key_length(c) + EVP_MD_size(h) +
  90                     EVP_CIPHER_iv_length(c));
  91 #endif
  92 }
  93
  94 /**
  95  * RFC 4851 section 5.1 - EAP-FAST Authentication Phase 1: Key Derivations
  96  */
  97 static void eap_fast_init_keys(REQUEST *request, tls_session_t *tls_session)
  98 {
  99         eap_fast_tunnel_t *t = tls_session->opaque;
 100         uint8_t *buf;
 101         uint8_t *scratch;
 102         size_t ksize;
 103
 104         RDEBUG2("Deriving EAP-FAST keys");
 105
 106         rad_assert(t->simck == NULL);
 107
 108         ksize = openssl_get_keyblock_size(request, tls_session->ssl);
 109         rad_assert(ksize > 0);
 110         buf = talloc_size(request, ksize + sizeof(*t->keyblock));
 111         scratch = talloc_size(request, ksize + sizeof(*t->keyblock));
 112
 113         t->keyblock = talloc(request, eap_fast_keyblock_t);
 114
 115         eap_fast_tls_gen_challenge(tls_session->ssl, buf, scratch, ksize + sizeof(*t->keyblock), "key expansion");
 116         memcpy(t->keyblock, &buf[ksize], sizeof(*t->keyblock));
 117         memset(buf, 0, ksize + sizeof(*t->keyblock));
 118
 119         t->simck = talloc_size(request, EAP_FAST_SIMCK_LEN);
 120         memcpy(t->simck, t->keyblock, EAP_FAST_SKS_LEN);        /* S-IMCK[0] = session_key_seed */
 121
 122         t->cmk = talloc_size(request, EAP_FAST_CMK_LEN);        /* note that CMK[0] is not defined */
 123         t->imckc = 0;
 124
 125         talloc_free(buf);
 126         talloc_free(scratch);
 127 }
 128
 129 /**
 130  * RFC 4851 section 5.2 - Intermediate Compound Key Derivations
 131  */
 132 static void eap_fast_update_icmk(REQUEST *request, tls_session_t *tls_session, uint8_t *msk)
 133 {
 134         eap_fast_tunnel_t *t = tls_session->opaque;
 135         uint8_t imck[EAP_FAST_SIMCK_LEN + EAP_FAST_CMK_LEN];
 136
 137         RDEBUG2("Updating ICMK");
 138
 139         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Inner Methods Compound Keys", msk, 32, imck, sizeof(imck));
 140
 141         memcpy(t->simck, imck, EAP_FAST_SIMCK_LEN);
 142         memcpy(t->cmk, &imck[EAP_FAST_SIMCK_LEN], EAP_FAST_CMK_LEN);
 143         t->imckc++;
 144
 145         /*
 146          * Calculate MSK/EMSK at the same time as they are coupled to ICMK
 147          *
 148          * RFC 4851 section 5.4 - EAP Master Session Key Generation
 149          */
 150         t->msk = talloc_size(request, EAP_FAST_KEY_LEN);
 151         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Session Key Generating Function", NULL, 0, t->msk, EAP_FAST_KEY_LEN);
 152
 153         t->emsk = talloc_size(request, EAP_EMSK_LEN);
 154         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Extended Session Key Generating Function", NULL, 0, t->emsk, EAP_EMSK_LEN);
 155 }
 156
 157 void eap_fast_tlv_append(tls_session_t *tls_session, int tlv, bool mandatory, int length, const void *data)
 158 {
 159         uint16_t hdr[2];
 160
 161         hdr[0] = (mandatory) ? htons(tlv | EAP_FAST_TLV_MANDATORY) : htons(tlv);
 162         hdr[1] = htons(length);
 163
 164         tls_session->record_plus(&tls_session->clean_in, &hdr, 4);
 165         tls_session->record_plus(&tls_session->clean_in, data, length);
 166 }
 167
 168 static void eap_fast_send_error(tls_session_t *tls_session, int error)
 169 {
 170         uint32_t value;
 171         value = htonl(error);
 172
 173         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_ERROR, true, sizeof(value), &value);
 174 }
 175
 176 static void eap_fast_append_result(tls_session_t *tls_session, PW_CODE code)
 177 {
 178         eap_fast_tunnel_t *t = (eap_fast_tunnel_t *) tls_session->opaque;
 179
 180         int type = (t->result_final)
 181                         ? EAP_FAST_TLV_RESULT
 182                         : EAP_FAST_TLV_INTERMED_RESULT;
 183
 184         uint16_t state = (code == PW_CODE_ACCESS_REJECT)
 185                         ? EAP_FAST_TLV_RESULT_FAILURE
 186                         : EAP_FAST_TLV_RESULT_SUCCESS;
 187         state = htons(state);
 188
 189         eap_fast_tlv_append(tls_session, type, true, sizeof(state), &state);
 190 }
 191
 192 static void eap_fast_send_identity_request(REQUEST *request, tls_session_t *tls_session, eap_handler_t *eap_session)
 193 {
 194         eap_packet_raw_t eap_packet;
 195
 196         RDEBUG("Sending EAP-Identity");
 197
 198         eap_packet.code = PW_EAP_REQUEST;
 199         eap_packet.id = eap_session->eap_ds->response->id + 1;
 200         eap_packet.length[0] = 0;
 201         eap_packet.length[1] = EAP_HEADER_LEN + 1;
 202         eap_packet.data[0] = PW_EAP_IDENTITY;
 203
 204         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_EAP_PAYLOAD, true, sizeof(eap_packet), &eap_packet);
 205 }
 206
 207 static void eap_fast_send_pac_tunnel(REQUEST *request, tls_session_t *tls_session)
 208 {
 209         eap_fast_tunnel_t                       *t = tls_session->opaque;
 210         eap_fast_pac_t                          pac;
 211         eap_fast_attr_pac_opaque_plaintext_t    opaque_plaintext;
 212         int                                     alen, dlen;
 213
 214         memset(&pac, 0, sizeof(pac));
 215         memset(&opaque_plaintext, 0, sizeof(opaque_plaintext));
 216
 217         RDEBUG("Sending Tunnel PAC");
 218
 219         pac.key.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_KEY);
 220         pac.key.hdr.length = htons(sizeof(pac.key.data));
 221         rad_assert(sizeof(pac.key.data) % sizeof(uint32_t) == 0);
 222         RANDFILL(pac.key.data);
 223
 224         pac.info.lifetime.hdr.type = htons(PAC_INFO_PAC_LIFETIME);
 225         pac.info.lifetime.hdr.length = htons(sizeof(pac.info.lifetime.data));
 226         pac.info.lifetime.data = htonl(time(NULL) + t->pac_lifetime);
 227
 228         pac.info.a_id.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_A_ID);
 229         pac.info.a_id.hdr.length = htons(sizeof(pac.info.a_id.data));
 230         memcpy(pac.info.a_id.data, t->a_id, sizeof(pac.info.a_id.data));
 231
 232         pac.info.a_id_info.hdr.type = htons(PAC_INFO_A_ID_INFO);
 233         pac.info.a_id_info.hdr.length = htons(sizeof(pac.info.a_id_info.data));
 234         #define MIN(a,b) (((a)>(b)) ? (b) : (a))
 235         alen = MIN(talloc_array_length(t->authority_identity) - 1, sizeof(pac.info.a_id_info.data));
 236         memcpy(pac.info.a_id_info.data, t->authority_identity, alen);
 237
 238         pac.info.type.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_TYPE);
 239         pac.info.type.hdr.length = htons(sizeof(pac.info.type.data));
 240         pac.info.type.data = htons(PAC_TYPE_TUNNEL);
 241
 242         pac.info.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_INFO);
 243         pac.info.hdr.length = htons(sizeof(pac.info.lifetime)
 244                                 + sizeof(pac.info.a_id)
 245                                 + sizeof(pac.info.a_id_info)
 246                                 + sizeof(pac.info.type));
 247
 248         memcpy(&opaque_plaintext.type, &pac.info.type, sizeof(opaque_plaintext.type));
 249         memcpy(&opaque_plaintext.lifetime, &pac.info.lifetime, sizeof(opaque_plaintext.lifetime));
 250         memcpy(&opaque_plaintext.key, &pac.key, sizeof(opaque_plaintext.key));
 251
 252
 253         rad_assert(PAC_A_ID_LENGTH <= EVP_GCM_TLS_TAG_LEN);
 254         memcpy(pac.opaque.aad, t->a_id, PAC_A_ID_LENGTH);
 255         rad_assert(RAND_bytes(pac.opaque.iv, sizeof(pac.opaque.iv)) != 0);
 256         dlen = eap_fast_encrypt((unsigned const char *)&opaque_plaintext, sizeof(opaque_plaintext),
 257                                     t->a_id, PAC_A_ID_LENGTH, t->pac_opaque_key, pac.opaque.iv,
 258                                     pac.opaque.data, pac.opaque.tag);
 259
 260         pac.opaque.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_OPAQUE);
 261         pac.opaque.hdr.length = htons(sizeof(pac.opaque) - sizeof(pac.opaque.hdr) - sizeof(pac.opaque.data) + dlen);
 262
 263         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_PAC, true,
 264                             sizeof(pac) - sizeof(pac.opaque.data) + dlen, &pac);
 265 }
 266
 267 static void eap_fast_append_crypto_binding(REQUEST *request, tls_session_t *tls_session)
 268 {
 269         eap_fast_tunnel_t               *t = tls_session->opaque;
 270         eap_tlv_crypto_binding_tlv_t    binding;
 271     memset(&binding, 0, sizeof(eap_tlv_crypto_binding_tlv_t));
 272         const int                       len = sizeof(binding) - (&binding.reserved - (uint8_t *)&binding);
 273
 274         RDEBUG("Sending Cryptobinding");
 275
 276         binding.tlv_type = htons(EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_CRYPTO_BINDING);
 277         binding.length = htons(len);
 278         binding.version = EAP_FAST_VERSION;
 279         binding.received_version = EAP_FAST_VERSION;    /* FIXME use the clients value */
 280         binding.subtype = EAP_FAST_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST;
 281
 282         rad_assert(sizeof(binding.nonce) % sizeof(uint32_t) == 0);
 283         RANDFILL(binding.nonce);
 284         binding.nonce[sizeof(binding.nonce) - 1] &= ~0x01; /* RFC 4851 section 4.2.8 */
 285
 286
 287         fr_hmac_sha1(binding.compound_mac, (uint8_t *)&binding, sizeof(binding), t->cmk, EAP_FAST_CMK_LEN);
 288
 289         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_CRYPTO_BINDING, true, len, &binding.reserved);
 290 }
 291
 292 static int eap_fast_verify(REQUEST *request, tls_session_t *tls_session, uint8_t const *data, unsigned int data_len)
 293 {
 294         uint16_t attr;
 295         uint16_t length;
 296         unsigned int remaining = data_len;
 297         int     total = 0;
 298         int     num[EAP_FAST_TLV_MAX] = {0};
 299         eap_fast_tunnel_t *t = (eap_fast_tunnel_t *) tls_session->opaque;
 300         uint32_t present = 0;
 301
 302         rad_assert(sizeof(present) * 8 > EAP_FAST_TLV_MAX);
 303
 304         while (remaining > 0) {
 305                 if (remaining < 4) {
 306                         RDEBUG2("EAP-FAST TLV is too small (%u) to contain a EAP-FAST TLV header", remaining);
 307                         return 0;
 308                 }
 309
 310                 memcpy(&attr, data, sizeof(attr));
 311                 attr = ntohs(attr) & EAP_FAST_TLV_TYPE;
 312
 313                 switch (attr) {
 314                 case EAP_FAST_TLV_RESULT:
 315                 case EAP_FAST_TLV_NAK:
 316                 case EAP_FAST_TLV_ERROR:
 317                 case EAP_FAST_TLV_VENDOR_SPECIFIC:
 318                 case EAP_FAST_TLV_EAP_PAYLOAD:
 319                 case EAP_FAST_TLV_INTERMED_RESULT:
 320                 case EAP_FAST_TLV_PAC:
 321                 case EAP_FAST_TLV_CRYPTO_BINDING:
 322                         num[attr]++;
 323                         present |= 1 << attr;
 324
 325                         if (num[EAP_FAST_TLV_EAP_PAYLOAD] > 1) {
 326                                 RDEBUG("Too many EAP-Payload TLVs");
 327 unexpected:
 328                                 for (int i = 0; i < EAP_FAST_TLV_MAX; i++)
 329                                         if (present & (1 << i))
 330                                                 RDEBUG(" - attribute %d is present", i);
 331                                 eap_fast_send_error(tls_session, EAP_FAST_ERR_UNEXPECTED_TLV);
 332                                 return 0;
 333                         }
 334
 335                         if (num[EAP_FAST_TLV_INTERMED_RESULT] > 1) {
 336                                 RDEBUG("Too many Intermediate-Result TLVs");
 337                                 goto unexpected;
 338                         }
 339                         break;
 340                 default:
 341                         if ((data[0] & 0x80) != 0) {
 342                                 RDEBUG("Unknown mandatory TLV %02x", attr);
 343                                 goto unexpected;
 344                         }
 345
 346                         num[0]++;
 347                 }
 348
 349                 total++;
 350
 351                 memcpy(&length, data + 2, sizeof(length));
 352                 length = ntohs(length);
 353
 354                 data += 4;
 355                 remaining -= 4;
 356
 357                 if (length > remaining) {
 358                         RDEBUG2("EAP-FAST TLV %u is longer than room remaining in the packet (%u > %u).", attr,
 359                                 length, remaining);
 360                         return 0;
 361                 }
 362
 363                 /*
 364                  * If the rest of the TLVs are larger than
 365                  * this attribute, continue.
 366                  *
 367                  * Otherwise, if the attribute over-flows the end
 368                  * of the TLCs, die.
 369                  */
 370                 if (remaining < length) {
 371                         RDEBUG2("EAP-FAST TLV overflows packet!");
 372                         return 0;
 373                 }
 374
 375                 /*
 376                  * If there's an error, we bail out of the
 377                  * authentication process before allocating
 378                  * memory.
 379                  */
 380                 if ((attr == EAP_FAST_TLV_INTERMED_RESULT) || (attr == EAP_FAST_TLV_RESULT)) {
 381                         uint16_t status;
 382
 383                         if (length < 2) {
 384                                 RDEBUG("EAP-FAST TLV %u is too short.  Expected 2, got %d.", attr, length);
 385                                 return 0;
 386                         }
 387
 388                         memcpy(&status, data, 2);
 389                         status = ntohs(status);
 390
 391                         if (status == EAP_FAST_TLV_RESULT_FAILURE) {
 392                                 RDEBUG("EAP-FAST TLV %u indicates failure.  Rejecting request.", attr);
 393                                 return 0;
 394                         }
 395
 396                         if (status != EAP_FAST_TLV_RESULT_SUCCESS) {
 397                                 RDEBUG("EAP-FAST TLV %u contains unknown value.  Rejecting request.", attr);
 398                                 goto unexpected;
 399                         }
 400                 }
 401
 402                 /*
 403                  * remaining > length, continue.
 404                  */
 405                 remaining -= length;
 406                 data += length;
 407         }
 408
 409         /*
 410          * Check if the peer mixed & matched TLVs.
 411          */
 412         if ((num[EAP_FAST_TLV_NAK] > 0) && (num[EAP_FAST_TLV_NAK] != total)) {
 413                 RDEBUG("NAK TLV sent with non-NAK TLVs.  Rejecting request.");
 414                 goto unexpected;
 415         }
 416
 417         if (num[EAP_FAST_TLV_INTERMED_RESULT] > 0 && num[EAP_FAST_TLV_RESULT]) {
 418                 RDEBUG("NAK TLV sent with non-NAK TLVs.  Rejecting request.");
 419                 goto unexpected;
 420         }
 421
 422         /*
 423          * Check mandatory or not mandatory TLVs.
 424          */
 425         switch (t->stage) {
 426         case TLS_SESSION_HANDSHAKE:
 427                 if (present) {
 428                         RDEBUG("Unexpected TLVs in TLS Session Handshake stage");
 429                         goto unexpected;
 430                 }
 431                 break;
 432         case AUTHENTICATION:
 433                 if (present != 1 << EAP_FAST_TLV_EAP_PAYLOAD) {
 434                         RDEBUG("Unexpected TLVs in authentication stage");
 435                         goto unexpected;
 436                 }
 437                 break;
 438         case CRYPTOBIND_CHECK:
 439         {
 440                 uint32_t bits = (t->result_final)
 441                                 ? 1 << EAP_FAST_TLV_RESULT
 442                                 : 1 << EAP_FAST_TLV_INTERMED_RESULT;
 443                 if (present & ~(bits | (1 << EAP_FAST_TLV_CRYPTO_BINDING) | (1 << EAP_FAST_TLV_PAC))) {
 444                         RDEBUG("Unexpected TLVs in cryptobind checking stage");
 445                         goto unexpected;
 446                 }
 447                 break;
 448         }
 449         case PROVISIONING:
 450                 if (present & ~((1 << EAP_FAST_TLV_PAC) | (1 << EAP_FAST_TLV_RESULT))) {
 451                         RDEBUG("Unexpected TLVs in provisioning stage");
 452                         goto unexpected;
 453                 }
 454                 break;
 455         case COMPLETE:
 456                 if (present) {
 457                         RDEBUG("Unexpected TLVs in complete stage");
 458                         goto unexpected;
 459                 }
 460                 break;
 461         default:
 462                 RDEBUG("Unexpected stage %d", t->stage);
 463                 return 0;
 464         }
 465
 466         /*
 467          * We got this far.  It looks OK.
 468          */
 469         return 1;
 470 }
 471
 472
 473 VALUE_PAIR *eap_fast_fast2vp(REQUEST *request, SSL *ssl, uint8_t const *data, size_t data_len,
 474                              DICT_ATTR const *fast_da, vp_cursor_t *out)
 475 {
 476         uint16_t        attr;
 477         uint16_t        length;
 478         size_t          data_left = data_len;
 479         VALUE_PAIR      *first = NULL;
 480         VALUE_PAIR      *vp = NULL;
 481         DICT_ATTR const *da;
 482
 483         if (!fast_da)
 484                 fast_da = dict_attrbyvalue(0, PW_EAP_FAST_TLV);
 485         rad_assert(fast_da != NULL);
 486
 487         if (!out) {
 488                 out = talloc(request, vp_cursor_t);
 489                 rad_assert(out != NULL);
 490                 fr_cursor_init(out, &first);
 491         }
 492
 493         /*
 494          * Decode the TLVs
 495          */
 496         while (data_left > 0) {
 497                 ssize_t decoded;
 498
 499                 /* FIXME do something with mandatory */
 500
 501                 memcpy(&attr, data, sizeof(attr));
 502                 attr = ntohs(attr) & EAP_FAST_TLV_TYPE;
 503
 504                 memcpy(&length, data + 2, sizeof(length));
 505                 length = ntohs(length);
 506
 507                 data += 4;
 508                 data_left -= 4;
 509
 510                 /*
 511                  * Look up the TLV.
 512                  *
 513                  * For now, if it doesn't exist, ignore it.
 514                  */
 515         da = dict_attrbyparent(fast_da, attr, 0);
 516                 if (!da) goto next_attr;
 517
 518                 if (da->type == PW_TYPE_TLV) {
 519                         eap_fast_fast2vp(request, ssl, data, length, da, out);
 520                         goto next_attr;
 521                 }
 522 /*
 523 ssize_t fr_radius_decode_pair_value(TALLOC_CTX *ctx, vp_cursor_t *cursor, fr_dict_attr_t const *parent,
 524                                     uint8_t const *data, size_t const attr_len, size_t const packet_len,
 525                                     void *decoder_ctx)
 526
 527         vp = NULL;
 528         decoded = rad_attr2vp(request->packet, NULL, NULL, NULL,
 529                       data, size + 2, &vp);
 530                 if (decoded < 0) {
 531                         RERROR("Failed decoding %s: %s", da->name, fr_strerror());
 532                         goto next_attr;
 533                 }
 534 */
 535
 536         next_attr:
 537                 while (fr_cursor_next(out)) {
 538                         /* nothing */
 539                 }
 540
 541                 data += length;
 542                 data_left -= length;
 543         }
 544
 545         /*
 546          * We got this far.  It looks OK.
 547          */
 548         return first;
 549 }
 550
 551
 552 static void eap_vp2fast(tls_session_t *tls_session, VALUE_PAIR *first)
 553 {
 554         VALUE_PAIR      *vp;
 555         vp_cursor_t     cursor;
 556
 557         for (vp = fr_cursor_init(&cursor, &first); vp; vp = fr_cursor_next(&cursor))
 558         {
 559                 if (vp->da->vendor != 0 && vp->da->attr != PW_EAP_MESSAGE) continue;
 560
 561                 eap_fast_tlv_append(tls_session, EAP_FAST_TLV_EAP_PAYLOAD, true, vp->vp_length, vp->vp_octets);
 562         }
 563 }
 564
 565
 566 /*
 567  * Use a reply packet to determine what to do.
 568  */
 569 static rlm_rcode_t CC_HINT(nonnull) process_reply( eap_handler_t *eap_session,
 570                                                   tls_session_t *tls_session,
 571                                                   REQUEST *request, RADIUS_PACKET *reply)
 572 {
 573         rlm_rcode_t                     rcode = RLM_MODULE_REJECT;
 574         VALUE_PAIR                      *vp, *tunnel_vps = NULL;
 575         vp_cursor_t                     cursor;
 576         vp_cursor_t                     to_tunnel;
 577
 578         eap_fast_tunnel_t       *t = tls_session->opaque;
 579
 580         rad_assert(eap_session->request == request);
 581
 582         /*
 583          * If the response packet was Access-Accept, then
 584          * we're OK.  If not, die horribly.
 585          *
 586          * FIXME: Take MS-CHAP2-Success attribute, and
 587          * tunnel it back to the client, to authenticate
 588          * ourselves to the client.
 589          *
 590          * FIXME: If we have an Access-Challenge, then
 591          * the Reply-Message is tunneled back to the client.
 592          *
 593          * FIXME: If we have an EAP-Message, then that message
 594          * must be tunneled back to the client.
 595          *
 596          * FIXME: If we have an Access-Challenge with a State
 597          * attribute, then do we tunnel that to the client, or
 598          * keep track of it ourselves?
 599          *
 600          * FIXME: EAP-Messages can only start with 'identity',
 601          * NOT 'eap start', so we should check for that....
 602          */
 603         switch (reply->code) {
 604         case PW_CODE_ACCESS_ACCEPT:
 605                 RDEBUG("Got tunneled Access-Accept");
 606                 /*
 607                  *      Always delete MPPE keys & encryption policy
 608                  *      from the tunneled reply.  These never get sent
 609                  *      back to the user.
 610                  */
 611                 fr_pair_delete_by_num(&reply->vps, 7, VENDORPEC_MICROSOFT, TAG_ANY);
 612                 fr_pair_delete_by_num(&reply->vps, 8, VENDORPEC_MICROSOFT, TAG_ANY);
 613                 fr_pair_delete_by_num(&reply->vps, 16, VENDORPEC_MICROSOFT, TAG_ANY);
 614                 fr_pair_delete_by_num(&reply->vps, 17, VENDORPEC_MICROSOFT, TAG_ANY);
 615
 616                 fr_cursor_init(&to_tunnel, &tunnel_vps);
 617                 rcode = RLM_MODULE_OK;
 618
 619                 /*
 620                  * Copy what we need into the TTLS tunnel and leave
 621                  * the rest to be cleaned up.
 622                  */
 623                 for (vp = fr_cursor_init(&cursor, &reply->vps); vp; vp = fr_cursor_next(&cursor)) {
 624                         switch (vp->da->vendor) {
 625                         case VENDORPEC_MICROSOFT:
 626                                 /* FIXME must be a better way to capture/re-derive this later for ISK */
 627                 switch(vp->da->attr) {
 628                 case PW_MSCHAP_MPPE_SEND_KEY:
 629                                         memcpy(t->isk.mppe_send, vp->vp_octets, CHAP_VALUE_LENGTH);
 630                     break;
 631
 632                 case PW_MSCHAP_MPPE_RECV_KEY:
 633                                         memcpy(t->isk.mppe_recv, vp->vp_octets, CHAP_VALUE_LENGTH);
 634                     break;
 635
 636                 case PW_MSCHAP2_SUCCESS:
 637                                         RDEBUG("Got %s, tunneling it to the client in a challenge", vp->da->name);
 638                                         rcode = RLM_MODULE_HANDLED;
 639                                         t->authenticated = true;
 640                     /* Look at copying the tunnel reply
 641                     fr_pair_list_mcopy_by_num(t, &tunnel_vps, &reply->vps, 0, 0, TAG_ANY);
 642                     */
 643                     break;
 644
 645                 default:
 646                     break;
 647                                 }
 648                                 break;
 649
 650                         default:
 651                                 break;
 652                         }
 653                 }
 654                 break;
 655
 656         case PW_CODE_ACCESS_REJECT:
 657                 RDEBUG("Got tunneled Access-Reject");
 658                 rcode = RLM_MODULE_REJECT;
 659                 break;
 660
 661         /*
 662          * Handle Access-Challenge, but only if we
 663          * send tunneled reply data.  This is because
 664          * an Access-Challenge means that we MUST tunnel
 665          * a Reply-Message to the client.
 666          */
 667         case PW_CODE_ACCESS_CHALLENGE:
 668                 RDEBUG("Got tunneled Access-Challenge");
 669
 670                 fr_cursor_init(&to_tunnel, &tunnel_vps);
 671
 672                 /*
 673                  * Copy what we need into the TTLS tunnel and leave
 674                  * the rest to be cleaned up.
 675                  */
 676                 for (vp = fr_cursor_init(&cursor, &reply->vps);
 677                      vp;
 678                      vp = fr_cursor_next(&cursor)) {
 679                         switch (vp->da->vendor) {
 680                         case 0:
 681                                 switch (vp->da->attr) {
 682                                 case PW_EAP_MESSAGE:
 683                                 case PW_REPLY_MESSAGE:
 684                                         fr_cursor_prepend(&to_tunnel, fr_pair_copy(tls_session, vp));
 685                                         break;
 686
 687                                 default:
 688                                         break;
 689
 690                                 }
 691
 692                         default:
 693                                 continue;
 694                         }
 695                 }
 696                 rcode = RLM_MODULE_HANDLED;
 697                 break;
 698
 699         default:
 700                 RDEBUG("Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 701                 rcode = RLM_MODULE_INVALID;
 702                 break;
 703         }
 704
 705
 706         /*
 707          * Pack any tunnelled VPs and send them back
 708          * to the supplicant.
 709          */
 710         if (tunnel_vps) {
 711                 RDEBUG("Sending tunneled reply attributes");
 712                 rdebug_pair_list(L_DBG_LVL_2, request, tunnel_vps, NULL);
 713
 714                 eap_vp2fast(tls_session, tunnel_vps);
 715                 fr_pair_list_free(&tunnel_vps);
 716         }
 717
 718         return rcode;
 719 }
 720
 721 static PW_CODE eap_fast_eap_payload(REQUEST *request, eap_handler_t *eap_session,
 722                                     tls_session_t *tls_session, VALUE_PAIR *tlv_eap_payload)
 723 {
 724         PW_CODE                 code = PW_CODE_ACCESS_REJECT;
 725         rlm_rcode_t             rcode;
 726         VALUE_PAIR              *vp;
 727         eap_fast_tunnel_t       *t;
 728         REQUEST                 *fake;
 729
 730         RDEBUG("Processing received EAP Payload");
 731
 732         /*
 733          * Allocate a fake REQUEST structure.
 734          */
 735         fake = request_alloc_fake(request);
 736         rad_assert(!fake->packet->vps);
 737
 738         t = (eap_fast_tunnel_t *) tls_session->opaque;
 739
 740         /*
 741          * Add the tunneled attributes to the fake request.
 742          */
 743
 744         fake->packet->vps = fr_pair_afrom_num(fake->packet, 0, PW_EAP_MESSAGE);
 745         fr_pair_value_memcpy(fake->packet->vps, tlv_eap_payload->vp_octets, tlv_eap_payload->vp_length);
 746
 747         RDEBUG("Got tunneled request");
 748         rdebug_pair_list(L_DBG_LVL_1, request, fake->packet->vps, NULL);
 749
 750         /*
 751          * Tell the request that it's a fake one.
 752          */
 753         fr_pair_make(fake->packet, &fake->packet->vps, "Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
 754
 755         /*
 756          * Update other items in the REQUEST data structure.
 757          */
 758         fake->username = fr_pair_find_by_num(fake->packet->vps, 0, PW_USER_NAME, TAG_ANY);
 759         fake->password = fr_pair_find_by_num(fake->packet->vps, 0, PW_USER_PASSWORD, TAG_ANY);
 760
 761         /*
 762          * No User-Name, try to create one from stored data.
 763          */
 764         if (!fake->username) {
 765                 /*
 766                  * No User-Name in the stored data, look for
 767                  * an EAP-Identity, and pull it out of there.
 768                  */
 769                 if (!t->username) {
 770                         vp = fr_pair_find_by_num(fake->packet->vps, 0, PW_EAP_MESSAGE, TAG_ANY);
 771                         if (vp &&
 772                             (vp->vp_length >= EAP_HEADER_LEN + 2) &&
 773                             (vp->vp_strvalue[0] == PW_EAP_RESPONSE) &&
 774                             (vp->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY) &&
 775                             (vp->vp_strvalue[EAP_HEADER_LEN + 1] != 0)) {
 776                                 /*
 777                                  * Create & remember a User-Name
 778                                  */
 779                                 t->username = fr_pair_make(t, NULL, "User-Name", NULL, T_OP_EQ);
 780                                 rad_assert(t->username != NULL);
 781
 782                                 fr_pair_value_bstrncpy(t->username, vp->vp_octets + 5, vp->vp_length - 5);
 783
 784                                 RDEBUG("Got tunneled identity of %s", t->username->vp_strvalue);
 785                         } else {
 786                                 /*
 787                                  * Don't reject the request outright,
 788                                  * as it's permitted to do EAP without
 789                                  * user-name.
 790                                  */
 791                                 RWDEBUG2("No EAP-Identity found to start EAP conversation");
 792                         }
 793                 } /* else there WAS a t->username */
 794
 795                 if (t->username) {
 796                         vp = fr_pair_list_copy(fake->packet, t->username);
 797                         fr_pair_add(&fake->packet->vps, vp);
 798                         fake->username = fr_pair_find_by_num(fake->packet->vps, 0, PW_USER_NAME, TAG_ANY);
 799                 }
 800         } /* else the request ALREADY had a User-Name */
 801
 802         if (t->stage == AUTHENTICATION) {       /* FIXME do this only for MSCHAPv2 */
 803                 VALUE_PAIR *tvp;
 804
 805                 tvp = fr_pair_afrom_num(fake->packet, 0, PW_EAP_TYPE);
 806                 tvp->vp_integer = t->default_provisioning_method;
 807                 fr_pair_add(&fake->config, tvp);
 808
 809                 /*
 810                  * RFC 5422 section 3.2.3 - Authenticating Using EAP-FAST-MSCHAPv2
 811                  */
 812                 if (t->mode == EAP_FAST_PROVISIONING_ANON) {
 813                         tvp = fr_pair_afrom_num(fake->packet, VENDORPEC_MICROSOFT, PW_MSCHAP_CHALLENGE);
 814                         fr_pair_value_memcpy(tvp, t->keyblock->server_challenge, CHAP_VALUE_LENGTH);
 815                         fr_pair_add(&fake->config, tvp);
 816
 817                         tvp = fr_pair_afrom_num(fake->packet, 0, PW_MS_CHAP_PEER_CHALLENGE);
 818                         fr_pair_value_memcpy(tvp, t->keyblock->client_challenge, CHAP_VALUE_LENGTH);
 819                         fr_pair_add(&fake->config, tvp);
 820                 }
 821         }
 822
 823         /*
 824          * Call authentication recursively, which will
 825          * do PAP, CHAP, MS-CHAP, etc.
 826          */
 827         eap_virtual_server(request, fake, eap_session, t->virtual_server);
 828
 829         /*
 830          * Decide what to do with the reply.
 831          */
 832         switch (fake->reply->code) {
 833         case 0:                 /* No reply code, must be proxied... */
 834 #ifdef WITH_PROXY
 835                 vp = fr_pair_find_by_num(fake->config, 0, PW_PROXY_TO_REALM, TAG_ANY);
 836                 if (vp) {
 837                         int                     ret;
 838                         eap_tunnel_data_t       *tunnel;
 839
 840                         RDEBUG("Tunneled authentication will be proxied to %s", vp->vp_strvalue);
 841
 842                         /*
 843                          * Tell the original request that it's going
 844                          * to be proxied.
 845                          */
 846                         fr_pair_list_mcopy_by_num(request, &request->config, &fake->config, 0,
 847                                                   PW_PROXY_TO_REALM, TAG_ANY);
 848
 849                         /*
 850                          * Seed the proxy packet with the
 851                          * tunneled request.
 852                          */
 853                         rad_assert(!request->proxy);
 854
 855                         request->proxy = talloc_steal(request, fake->packet);
 856
 857                         memset(&request->proxy->src_ipaddr, 0,
 858                                sizeof(request->proxy->src_ipaddr));
 859                         memset(&request->proxy->src_ipaddr, 0,
 860                                sizeof(request->proxy->src_ipaddr));
 861                         request->proxy->src_port = 0;
 862                         request->proxy->dst_port = 0;
 863                         fake->packet = NULL;
 864                         fr_radius_free(&fake->reply);
 865                         fake->reply = NULL;
 866
 867                         /*
 868                          * Set up the callbacks for the tunnel
 869                          */
 870                         tunnel = talloc_zero(request, eap_tunnel_data_t);
 871                         tunnel->tls_session = tls_session;
 872
 873                         /*
 874                          * Associate the callback with the request.
 875                          */
 876                         ret = request_data_add(request, request->proxy, REQUEST_DATA_EAP_TUNNEL_CALLBACK,
 877                                                tunnel, false, false, false);
 878                         rad_cond_assert(ret == 0);
 879
 880                         /*
 881                          * rlm_eap.c has taken care of associating
 882                          * the eap_session with the fake request.
 883                          *
 884                          * So we associate the fake request with
 885                          * this request.
 886                          */
 887                         ret = request_data_add(request, request->proxy, REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
 888                                                fake, true, false, false);
 889                         rad_cond_assert(ret == 0);
 890
 891                         fake = NULL;
 892
 893                         /*
 894                          * Didn't authenticate the packet, but
 895                          * we're proxying it.
 896                          */
 897                         code = PW_CODE_STATUS_CLIENT;
 898
 899                 } else
 900 #endif  /* WITH_PROXY */
 901                   {
 902                           RDEBUG("No tunneled reply was found, and the request was not proxied: rejecting the user.");
 903                           code = PW_CODE_ACCESS_REJECT;
 904                   }
 905                 break;
 906
 907         default:
 908                 /*
 909                  * Returns RLM_MODULE_FOO, and we want to return PW_FOO
 910                  */
 911                 rcode = process_reply(eap_session, tls_session, request, fake->reply);
 912                 switch (rcode) {
 913                 case RLM_MODULE_REJECT:
 914                         code = PW_CODE_ACCESS_REJECT;
 915                         break;
 916
 917                 case RLM_MODULE_HANDLED:
 918                         code = PW_CODE_ACCESS_CHALLENGE;
 919                         break;
 920
 921                 case RLM_MODULE_OK:
 922                         code = PW_CODE_ACCESS_ACCEPT;
 923                         break;
 924
 925                 default:
 926                         code = PW_CODE_ACCESS_REJECT;
 927                         break;
 928                 }
 929                 break;
 930         }
 931
 932         talloc_free(fake);
 933
 934         return code;
 935 }
 936
 937 static PW_CODE eap_fast_crypto_binding(REQUEST *request, UNUSED eap_handler_t *eap_session,
 938                                        tls_session_t *tls_session, eap_tlv_crypto_binding_tlv_t *binding)
 939 {
 940         uint8_t                 cmac[sizeof(binding->compound_mac)];
 941         eap_fast_tunnel_t       *t = tls_session->opaque;
 942
 943         memcpy(cmac, binding->compound_mac, sizeof(cmac));
 944         memset(binding->compound_mac, 0, sizeof(binding->compound_mac));
 945
 946
 947         fr_hmac_sha1(binding->compound_mac, (uint8_t *)binding, sizeof(*binding), t->cmk, EAP_FAST_CMK_LEN);
 948         if (memcmp(binding->compound_mac, cmac, sizeof(cmac))) {
 949                 RDEBUG2("Crypto-Binding TLV mis-match");
 950                 return PW_CODE_ACCESS_REJECT;
 951         }
 952
 953         return PW_CODE_ACCESS_ACCEPT;
 954 }
 955
 956 static PW_CODE eap_fast_process_tlvs(REQUEST *request, eap_handler_t *eap_session,
 957                                      tls_session_t *tls_session, VALUE_PAIR *fast_vps)
 958 {
 959         eap_fast_tunnel_t               *t = (eap_fast_tunnel_t *) tls_session->opaque;
 960         VALUE_PAIR                      *vp;
 961         vp_cursor_t                     cursor;
 962         eap_tlv_crypto_binding_tlv_t    *binding = NULL;
 963
 964         for (vp = fr_cursor_init(&cursor, &fast_vps); vp; vp = fr_cursor_next(&cursor)) {
 965                 PW_CODE code = PW_CODE_ACCESS_REJECT;
 966                 char *value;
 967         DICT_ATTR * parent = dict_parent(vp->da->attr, vp->da->vendor);
 968
 969                 switch (parent->attr) {
 970                 case PW_EAP_FAST_TLV:
 971                         switch (vp->da->attr) {
 972                         case EAP_FAST_TLV_EAP_PAYLOAD:
 973                                 code = eap_fast_eap_payload(request, eap_session, tls_session, vp);
 974                                 if (code == PW_CODE_ACCESS_ACCEPT)
 975                                         t->stage = CRYPTOBIND_CHECK;
 976                                 break;
 977                         case EAP_FAST_TLV_RESULT:
 978                         case EAP_FAST_TLV_INTERMED_RESULT:
 979                                 code = PW_CODE_ACCESS_ACCEPT;
 980                                 t->stage = PROVISIONING;
 981                                 break;
 982                         default:
 983                                 value = fr_pair_asprint(request->packet, vp, '"');
 984                                 RDEBUG2("ignoring unknown %s", value);
 985                                 talloc_free(value);
 986                                 continue;
 987                         }
 988                         break;
 989                 case EAP_FAST_TLV_CRYPTO_BINDING:
 990                         if (!binding) {
 991                                 binding = talloc_zero(request->packet, eap_tlv_crypto_binding_tlv_t);
 992                                 binding->tlv_type = htons(EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_CRYPTO_BINDING);
 993                                 binding->length = htons(sizeof(*binding) - 2 * sizeof(uint16_t));
 994                         }
 995                         /*
 996                          * fr_radius_encode_pair() does not work for structures
 997                          */
 998                         switch (vp->da->attr) {
 999                         case 1: /* PW_EAP_FAST_CRYPTO_BINDING_RESERVED */
1000                                 binding->reserved = vp->vp_integer;
1001                                 break;
1002                         case 2: /* PW_EAP_FAST_CRYPTO_BINDING_VERSION */
1003                                 binding->version = vp->vp_integer;
1004                                 break;
1005                         case 3: /* PW_EAP_FAST_CRYPTO_BINDING_RECV_VERSION */
1006                                 binding->received_version = vp->vp_integer;
1007                                 break;
1008                         case 4: /* PW_EAP_FAST_CRYPTO_BINDING_SUB_TYPE */
1009                                 binding->subtype = vp->vp_integer;
1010                                 break;
1011                         case 5: /* PW_EAP_FAST_CRYPTO_BINDING_NONCE */
1012                                 memcpy(binding->nonce, vp->vp_octets, vp->vp_length);
1013                                 break;
1014                         case 6: /* PW_EAP_FAST_CRYPTO_BINDING_COMPOUND_MAC */
1015                                 memcpy(binding->compound_mac, vp->vp_octets, vp->vp_length);
1016                                 break;
1017                         }
1018                         continue;
1019                 case EAP_FAST_TLV_PAC:
1020                         switch (vp->da->attr) {
1021                         case PAC_INFO_PAC_ACK:
1022                                 if (vp->vp_integer == EAP_FAST_TLV_RESULT_SUCCESS) {
1023                                         code = PW_CODE_ACCESS_ACCEPT;
1024                                         t->pac.expires = UINT32_MAX;
1025                                         t->pac.expired = false;
1026                                         t->stage = COMPLETE;
1027                                 }
1028                                 break;
1029                         case PAC_INFO_PAC_TYPE:
1030                                 if (vp->vp_integer != PAC_TYPE_TUNNEL) {
1031                                         RDEBUG("only able to serve Tunnel PAC's, ignoring request");
1032                                         continue;
1033                                 }
1034                                 t->pac.send = true;
1035                                 continue;
1036                         default:
1037                                 value = fr_pair_asprint(request->packet, vp, '"');
1038                                 RDEBUG2("ignoring unknown EAP-FAST-PAC-TLV %s", value);
1039                                 talloc_free(value);
1040                                 continue;
1041                         }
1042                         break;
1043                 default:
1044                         value = fr_pair_asprint(request->packet, vp, '"');
1045                         RDEBUG2("ignoring non-EAP-FAST TLV %s", value);
1046                         talloc_free(value);
1047                         continue;
1048                 }
1049
1050                 if (code == PW_CODE_ACCESS_REJECT)
1051                         return PW_CODE_ACCESS_REJECT;
1052         }
1053
1054         if (binding) {
1055                 PW_CODE code = eap_fast_crypto_binding(request, eap_session, tls_session, binding);
1056                 if (code == PW_CODE_ACCESS_ACCEPT)
1057                         t->stage = PROVISIONING;
1058         }
1059
1060         return PW_CODE_ACCESS_ACCEPT;
1061 }
1062
1063
1064 /*
1065  * Process the inner tunnel data
1066  */
1067 PW_CODE eap_fast_process(eap_handler_t *eap_session, tls_session_t *tls_session)
1068 {
1069         PW_CODE                 code;
1070         VALUE_PAIR              *fast_vps;
1071         uint8_t                 const *data;
1072         size_t                  data_len;
1073         eap_fast_tunnel_t               *t;
1074         REQUEST                 *request = eap_session->request;
1075
1076         /*
1077          * Just look at the buffer directly, without doing
1078          * record_to_buff.
1079          */
1080         data_len = tls_session->clean_out.used;
1081         tls_session->clean_out.used = 0;
1082         data = tls_session->clean_out.data;
1083
1084         t = (eap_fast_tunnel_t *) tls_session->opaque;
1085
1086         /*
1087          * See if the tunneled data is well formed.
1088          */
1089         if (!eap_fast_verify(request, tls_session, data, data_len)) return PW_CODE_ACCESS_REJECT;
1090
1091         if (t->stage == TLS_SESSION_HANDSHAKE) {
1092                 rad_assert(t->mode == EAP_FAST_UNKNOWN);
1093
1094                 char buf[256];
1095                 if (strstr(SSL_CIPHER_description(SSL_get_current_cipher(tls_session->ssl),
1096                                                   buf, sizeof(buf)), "Au=None")) {
1097                         /* FIXME enforce MSCHAPv2 - RFC 5422 section 3.2.2 */
1098                         RDEBUG2("Using anonymous provisioning");
1099                         t->mode = EAP_FAST_PROVISIONING_ANON;
1100                         t->pac.send = true;
1101                 } else {
1102                         if (SSL_session_reused(tls_session->ssl)) {
1103                                 RDEBUG("Session Resumed from PAC");
1104                                 t->mode = EAP_FAST_NORMAL_AUTH;
1105                         } else {
1106                                 RDEBUG2("Using authenticated provisioning");
1107                                 t->mode = EAP_FAST_PROVISIONING_AUTH;
1108                         }
1109
1110                         if (!t->pac.expires || t->pac.expired || t->pac.expires - time(NULL) < t->pac_lifetime * 0.6)
1111                                 t->pac.send = true;
1112                 }
1113
1114                 eap_fast_init_keys(request, tls_session);
1115
1116                 eap_fast_send_identity_request(request, tls_session, eap_session);
1117
1118                 t->stage = AUTHENTICATION;
1119                 return PW_CODE_ACCESS_CHALLENGE;
1120         }
1121
1122         fast_vps = eap_fast_fast2vp(request, tls_session->ssl, data, data_len, NULL, NULL);
1123
1124         RDEBUG("Got Tunneled FAST TLVs");
1125         rdebug_pair_list(L_DBG_LVL_1, request, fast_vps, NULL);
1126
1127         code = eap_fast_process_tlvs(request, eap_session, tls_session, fast_vps);
1128
1129         fr_pair_list_free(&fast_vps);
1130
1131         if (code == PW_CODE_ACCESS_REJECT) return PW_CODE_ACCESS_REJECT;
1132
1133         switch (t->stage) {
1134         case AUTHENTICATION:
1135                 code = PW_CODE_ACCESS_CHALLENGE;
1136                 break;
1137         case CRYPTOBIND_CHECK:
1138         {
1139                 if (t->mode != EAP_FAST_PROVISIONING_ANON && !t->pac.send)
1140                         t->result_final = true;
1141
1142                 eap_fast_append_result(tls_session, code);
1143
1144                 eap_fast_update_icmk(request, tls_session, (uint8_t *)&t->isk);
1145                 eap_fast_append_crypto_binding(request, tls_session);
1146
1147                 code = PW_CODE_ACCESS_CHALLENGE;
1148                 break;
1149         }
1150         case PROVISIONING:
1151                 t->result_final = true;
1152
1153                 eap_fast_append_result(tls_session, code);
1154
1155                 if (code == PW_CODE_ACCESS_REJECT)
1156                         break;
1157
1158                 if (t->pac.send) {
1159                         RDEBUG("Peer requires new PAC");
1160                         eap_fast_send_pac_tunnel(request, tls_session);
1161                         code = PW_CODE_ACCESS_CHALLENGE;
1162                         break;
1163                 }
1164
1165                 t->stage = COMPLETE;
1166                 /* fallthrough */
1167         case COMPLETE:
1168                 /*
1169                  * RFC 5422 section 3.5 - Network Access after EAP-FAST Provisioning
1170                  */
1171                 if ((t->pac.type && t->pac.expired) || t->mode == EAP_FAST_PROVISIONING_ANON) {
1172                         RDEBUG("Rejecting expired PAC or unauthenticated provisioning");
1173                         code = PW_CODE_ACCESS_REJECT;
1174                         break;
1175                 }
1176
1177                 /*
1178                  * eap_tls_gen_mppe_keys() is unsuitable for EAP-FAST as Cisco decided
1179                  * it would be a great idea to flip the recv/send keys around
1180                  */
1181                 #define EAPTLS_MPPE_KEY_LEN 32
1182                 eap_add_reply(request, "MS-MPPE-Recv-Key", t->msk, EAPTLS_MPPE_KEY_LEN);
1183                 eap_add_reply(request, "MS-MPPE-Send-Key", &t->msk[EAPTLS_MPPE_KEY_LEN], EAPTLS_MPPE_KEY_LEN);
1184                 eap_add_reply(request, "EAP-MSK", t->msk, EAP_FAST_KEY_LEN);
1185                 eap_add_reply(request, "EAP-EMSK", t->emsk, EAP_EMSK_LEN);
1186
1187                 break;
1188         default:
1189                 RERROR("no idea! %d", t->stage);
1190                 code = PW_CODE_ACCESS_REJECT;
1191         }
1192
1193         return code;
1194 }